View Full Cisco 200-201 Exam Dumps and Practice Test Dumps.

 

Question 121

Which security mechanism helps prevent unauthorized users from accessing a wireless network by requiring a shared secret for authentication?

1. Port mirroring
2. WPA2-PSK
3. DHCP snooping
4. DNSSEC

Correct Answer: 2

Explanation

WPA2-PSK uses a pre-shared key to authenticate users or devices joining a wireless network. The shared secret is configured on the wireless access point and authorized clients. WPA2-PSK can provide strong wireless protection when a long, unique passphrase is used and the network is configured appropriately. However, because the same key may be shared among multiple users, enterprise environments often use 802.1X with centralized authentication for stronger individual accountability. Port mirroring copies traffic for monitoring, DHCP snooping protects against rogue DHCP servers, and DNSSEC protects DNS data integrity. Therefore, WPA2-PSK is correct.

Question 122

Which wireless authentication method commonly uses individual user credentials instead of one shared password for the entire network?

1. Open authentication
2. WEP
3. WPA2-Enterprise
4. Static MAC filtering

Correct Answer: 3

Explanation

WPA2-Enterprise uses 802.1X and an authentication framework such as EAP to provide individual authentication for wireless users. Instead of giving every user the same pre-shared key, the organization can authenticate users through a centralized authentication server. This improves accountability and makes it easier to revoke access for a specific user without changing credentials for everyone. Open authentication does not provide strong authentication, WEP is outdated and insecure, and MAC filtering is not a complete authentication mechanism. Therefore, WPA2-Enterprise is the correct choice for individual user authentication.

Question 123

Which EAP component is responsible for requesting authentication credentials from a wireless client?

1. Supplicant
2. Authenticator
3. Authentication server
4. DNS resolver

Correct Answer: 2

Explanation

In an 802.1X environment, the authenticator is typically the network device, such as a wireless access point or switch, that controls access to the network. It facilitates communication between the supplicant and the authentication server. The supplicant is the endpoint requesting network access, while the authentication server validates the user’s credentials and returns an authorization result. A DNS resolver performs name resolution and does not participate directly in the 802.1X authentication process. Therefore, the authenticator is the component that controls access and facilitates the authentication exchange.

Question 124

Which component of an 802.1X architecture runs on the endpoint requesting network access?

1. Supplicant
2. Authenticator
3. RADIUS proxy
4. Certificate Authority

Correct Answer: 1

Explanation

The supplicant is the software or component running on an endpoint that requests access to the network using 802.1X. Examples include a laptop, desktop, or mobile device configured to authenticate through an appropriate EAP method. The authenticator, commonly a switch or wireless access point, controls access to the network. The authentication server, often using RADIUS, validates the credentials and determines whether access should be granted. A Certificate Authority issues certificates when certificate-based authentication is used. Therefore, the endpoint requesting network access is the supplicant.

Question 125

Which Cisco security solution can provide centralized identity-based network access control and policy enforcement?

1. Cisco ISE
2. Cisco IOS only
3. Cisco NTP
4. Cisco DHCP relay

Correct Answer: 1

Explanation

Cisco Identity Services Engine, or Cisco ISE, provides centralized identity-based access control and policy enforcement. It can integrate with authentication systems, endpoint information, profiling, posture assessment, and network devices to determine appropriate access. For example, an organization can use ISE to place employees, guests, and noncompliant devices into different network segments based on identity and security policies. NTP provides time synchronization, DHCP relay forwards DHCP messages, and IOS is the operating system used on many Cisco devices rather than a centralized identity-management platform. Therefore, Cisco ISE is correct.

Question 126

Which AAA function determines what resources or actions an authenticated user is allowed to access?

1. Authentication
2. Authorization
3. Accounting
4. Auditing

Correct Answer: 2

Explanation

Authorization determines what an authenticated user, device, or application is permitted to access or perform. Authentication answers the question of who the user or device is, while authorization determines what that identity is allowed to do. Accounting records information about activities such as login sessions, commands, or resource usage. For example, an administrator may successfully authenticate but only be authorized to perform specific configuration commands. Proper authorization supports least privilege and reduces the potential impact of compromised accounts. Therefore, authorization is the AAA function responsible for permissions and access decisions.

Question 127

Which AAA function records information about a user’s network session and resource usage?

1. Authorization
2. Authentication
3. Accounting
4. Encryption

Correct Answer: 3

Explanation

Accounting records information about user activity and resource usage within an AAA framework. Depending on the system, accounting records may include login and logout times, session duration, commands executed, network resources accessed, or data transferred. These records can support auditing, troubleshooting, security investigations, and compliance requirements. Authentication verifies identity, authorization determines permissions, and encryption protects information from unauthorized disclosure. Accounting is therefore an important part of centralized access management because it provides visibility into what authenticated users actually did during their sessions. The correct answer is accounting.

Question 128

Which AAA function verifies the identity of a user or device before access is granted?

1. Accounting
2. Authorization
3. Authentication
4. Segmentation

Correct Answer: 3

Explanation

Authentication is the process of verifying the identity of a user, device, or service before access is provided. Common authentication methods include passwords, certificates, security keys, tokens, and biometrics. In a centralized AAA environment, the authentication request can be forwarded to a dedicated authentication server such as a RADIUS or TACACS+ server. Authorization occurs after successful authentication and determines the permissions available to the identity. Accounting records activities and sessions. Therefore, authentication is the AAA function responsible for verifying identity.

Question 129

Which access-control approach assigns permissions directly to individual users rather than primarily through predefined roles?

1. Role-Based Access Control
2. Attribute-Based Access Control
3. Discretionary Access Control
4. Mandatory Access Control

Correct Answer: 3

Explanation

Discretionary Access Control, or DAC, allows resource owners or authorized users to control access to resources and assign permissions to individual users or groups. The owner has discretion over who can access a resource. In contrast, Role-Based Access Control assigns permissions according to organizational roles, while Mandatory Access Control relies on centrally defined security classifications and policies. Attribute-Based Access Control makes decisions based on attributes such as user identity, device status, location, or resource characteristics. Therefore, DAC is the model most closely associated with resource owners directly assigning access permissions.

Question 130

Which access-control model makes decisions using attributes such as user identity, device type, location, and time?

1. DAC
2. RBAC
3. ABAC
4. Static ACL

Correct Answer: 3

Explanation

Attribute-Based Access Control, or ABAC, evaluates attributes associated with users, devices, resources, actions, and environmental conditions when making access decisions. For example, a policy might allow an employee to access a sensitive application only when using a managed device from an approved location during business hours. This provides more context-aware access decisions than simply assigning permissions based on a user’s role. DAC generally allows resource owners to control access, while RBAC primarily uses predefined roles. Therefore, ABAC is the appropriate model for decisions based on multiple contextual attributes.

Question 131

Which type of ACL filters traffic based primarily on source IP address?

1. Extended ACL
2. Standard ACL
3. MAC ACL
4. Application ACL

Correct Answer: 2

Explanation

A standard IPv4 ACL primarily evaluates the source IP address when making a traffic-filtering decision. It can be used when the security requirement is based mainly on where traffic originates. Extended ACLs provide more detailed filtering and can evaluate criteria such as source and destination addresses, protocols, and ports. ACLs should be carefully ordered because entries are evaluated according to their configured sequence, and an implicit deny exists at the end of an ACL. Therefore, a standard ACL is the type primarily based on the source IP address.

Question 132

Which type of ACL can filter traffic based on source IP, destination IP, protocol, and TCP or UDP port?

1. Standard ACL
2. Extended ACL
3. Host-only ACL
4. Management ACL

Correct Answer: 2

Explanation

An extended ACL provides more granular traffic filtering than a standard ACL. Depending on the platform and configuration, it can evaluate source and destination IP addresses, IP protocols, and TCP or UDP port numbers. This allows administrators to create rules such as permitting HTTPS traffic from a specific network to a particular server while denying other services. Standard ACLs primarily use source addresses. Proper ACL design requires careful rule ordering and consideration of the implicit deny at the end. Therefore, an extended ACL is the correct answer.

Question 133

What happens to traffic that reaches the end of an ACL without matching any explicit permit statement?

1. It is automatically permitted
2. It is redirected to DNS
3. It is denied by the implicit deny
4. It is encrypted automatically

Correct Answer: 3

Explanation

Most Cisco ACL processing includes an implicit deny at the end of the access-control list. If a packet does not match any configured permit or deny statement, it is denied by default. This behavior is important when designing ACLs because administrators must explicitly permit legitimate traffic that should be allowed. For example, an ACL containing only a rule denying one specific host will also deny other traffic unless appropriate permit statements are included afterward. The implicit deny provides a secure default behavior. Therefore, unmatched traffic is denied by the implicit deny.

Question 134

Which ACL type is generally recommended when detailed control over specific network services is required?

1. Extended ACL
2. Standard ACL
3. Default gateway ACL
4. Loopback ACL

Correct Answer: 1

Explanation

Extended ACLs provide detailed traffic-control capabilities because they can evaluate multiple characteristics of network traffic. Depending on the platform, these can include source and destination addresses, protocols, and port numbers. This allows administrators to permit or deny specific services rather than simply controlling traffic based on its source. Standard ACLs provide more limited filtering, primarily based on source addresses. Extended ACLs should be designed carefully to avoid accidentally blocking required services or creating unintended access. Therefore, an extended ACL is generally appropriate when detailed service-level filtering is required.

Question 135

Which network security technique separates sensitive systems from less-trusted systems to limit lateral movement?

1. Network segmentation
2. Data compression
3. Load balancing
4. File synchronization

Correct Answer: 1

Explanation

Network segmentation divides a network into separate logical or physical security zones and restricts communication between those zones according to security policies. Sensitive servers, user networks, guest devices, and public-facing systems can be placed into different segments. If an attacker compromises one segment, segmentation can limit the attacker’s ability to move directly to other systems. Technologies such as VLANs, firewalls, ACLs, and software-defined security policies can support segmentation. Data compression reduces file size, load balancing distributes traffic, and file synchronization copies information. Therefore, network segmentation is correct.

Question 136

Which security principle assumes that access should be continuously verified rather than automatically trusted based on network location?

1. Perimeter security
2. Zero Trust
3. Open networking
4. Shared access

Correct Answer: 2

Explanation

Zero Trust is a security approach that does not automatically trust users or devices simply because they are inside a corporate network. Access requests are evaluated using factors such as identity, device posture, resource sensitivity, context, and policy. Continuous verification and least-privilege access are central concepts. This approach can help reduce the impact of compromised credentials and lateral movement by limiting unnecessary access. Traditional perimeter security can place greater emphasis on the network boundary, while open or shared access models provide less restrictive controls. Therefore, Zero Trust is the correct security principle.

Question 137

Which security control helps detect unusual login activity by recording successful and failed authentication attempts?

1. Audit logging
2. NAT
3. VLAN trunking
4. Load balancing

Correct Answer: 1

Explanation

Audit logging records security-relevant events, including successful and failed authentication attempts. Reviewing these logs can help identify password guessing, brute-force attempts, compromised accounts, unusual login locations, and other suspicious behavior. Centralized log collection and correlation can make it easier for security teams to identify patterns across multiple systems. NAT performs address translation, VLAN trunking carries traffic for multiple VLANs, and load balancing distributes workloads. Logs should be protected from unauthorized modification and retained according to organizational requirements. Therefore, audit logging is the correct control for recording authentication activity.

Question 138

Which security technology can isolate a compromised endpoint from the network while allowing security personnel to investigate it?

1. EDR
2. DNS
3. DHCP
4. NTP

Correct Answer: 1

Explanation

Endpoint Detection and Response, or EDR, provides visibility into endpoint activity and can support security response actions. One common response capability is network isolation, which can prevent a compromised endpoint from communicating with other systems while preserving the endpoint for investigation. EDR platforms can collect information about processes, files, connections, and other activity to help analysts determine what occurred. DNS resolves names, DHCP provides network configuration, and NTP synchronizes clocks. Therefore, EDR is the technology that can provide endpoint monitoring and response capabilities such as isolation.

Question 139

Which security solution can inspect endpoint behavior and provide telemetry about suspicious processes, files, and connections?

1. EDR
2. RAID
3. NAT
4. DNS

Correct Answer: 1

Explanation

Endpoint Detection and Response systems monitor endpoint activity and collect telemetry related to processes, files, network connections, user actions, and system changes. Security teams can use this information to investigate suspicious behavior and determine whether an endpoint may have been compromised. EDR can also support automated or analyst-driven response actions depending on the product and configuration. RAID protects storage through redundancy, NAT translates network addresses, and DNS resolves domain names. EDR complements other security technologies rather than replacing network security controls. Therefore, EDR is the correct solution for endpoint behavioral visibility.

Question 140

Which security practice helps ensure that critical systems can be restored after a major outage or destructive incident?

1. Port scanning
2. Disaster recovery planning
3. Password reuse
4. Open authentication

Correct Answer: 2

Explanation

Disaster recovery planning establishes procedures and resources for restoring critical systems and services after major disruptions. Plans may address backup restoration, alternate infrastructure, recovery priorities, communication procedures, responsible personnel, and recovery objectives. Regular testing is important because an untested recovery plan may fail when it is actually needed. Port scanning identifies network services, password reuse increases security risk, and open authentication provides insufficient access protection. Disaster recovery planning works alongside business continuity, backup strategies, redundancy, and incident response. Therefore, disaster recovery planning is the correct security practice.